[delfinom]

>we use very, very few off the shelf solutions.

Even off the shelf is no solution really. Everything is proprietary, you get locked in and years later the vendor isn't maintaining shit and moving away becomes an blackhole of a cost sink.

>It's INCREDIBLY common for nurses and doctors to need to have administrator access on their Windows desktops for various apps.

Honestly, needing admin on a "user network" device isn't the worst. You can still run malware that attacks the network via non-admin context :/ The best move is to use AppLocker if it's critical.